Browser extension

Deploy Discover by NeuralTrust to monitor and control employee use of third-party AI services in managed browsers

Discover by NeuralTrust is a managed browser extension that monitors employee use of third-party AI services. It records service use and prompt activity, and can block or mask prompts before they leave a managed browser.

This is not a TrustGuard collector. Collectors call /v1/evaluate with a tgk_… key and enforce a runtime policy. The extension is a separate integration: it reports discovery and activity to the AISPM and Data Plane APIs, and checks prompts against the Actions API. It is configured entirely through managed browser policy; there is no collector to create for it.

What it covers

Surface	Monitor	Block	Redact
Prompt, before it is sent	✅	✅	✅
Attachments, before upload	✅	✅	➖
Model response	✅	❌	❌

Use the extension for third-party AI services accessed through managed browsers. For AI applications you operate, use a TrustGuard collector. See How it works for supported enforcement.

Limits.

• Managed browsers only. A personal device, a personal browser profile, or the native desktop app of the same AI service is outside its coverage.
• Model responses are recorded, not enforced. They reach activity so you can see what came back, but no policy decision is applied to them.
• Chrome and Edge only. The extension ships as a Chrome Manifest V3 package that also runs in Edge. There is no Firefox build.
• Site-level blocking through declarativeNetRequest is not driven by policy today; enforcement happens per prompt, at submit time.

How it works

The extension runs three layers in the browser:

Layer	What it does
Injected	Page-context interceptors over fetch, XHR and WebSocket, plus a prompt extractor that knows the shape of each AI app
Content	Policy bridge, DOM monitor and the toast notifications the user sees
Background	Service worker: identity, config and policy sync, event buffering, and the moderation call

When a user submits a prompt, the extension extracts it, sends it for evaluation, and acts on the verdict before the request leaves the browser:

• Allowed: the request proceeds and the interaction is recorded.
• Masked: sensitive spans are replaced and the masked text is submitted instead. When the PII mode is set to enforce, the same finding blocks instead of masking.
• Blocked: the request is not sent. The Access Blocked page can show your customBlockMessage, support email, and IT portal link.

Attachments are checked on the same path before upload.

Identity

The extension attributes activity to a real person rather than a device.

userId and userEmail can be pushed through managed policy. To let the browser establish identity, enable Microsoft Entra ID sign-in with entraLoginEnabled, entraTenantId and entraClientId. Sessions are grouped automatically, so no per-site configuration is needed.

Deploy

Push the extension to managed endpoints with Chrome or Edge enterprise policy, using MDM, GPO, or Intune. Force-install it on devices where the policy must apply.

Configuration arrives through the browser’s managed storage, not through a console. Four keys are required:

Key	Required	What it is
teamId	✅	Your organization identifier
integrationId	✅	The shadow-extension integration identifier
aispmEndpoint · aispmToken	✅	AISPM API for discovery and inventory
dataPlaneEndpoint · dataPlaneToken		Data Plane API for activity ingestion (JWT bearer)
actionsEndpoint · actionsApiKey		Actions API for prompt checks, sent as X-TG-API-Key

Without the Actions keys, the extension observes and reports but does not enforce.

Behavior

Key	What it controls
syncInterval	How often buffered activity is flushed, in minutes
policyRefreshInterval	How often policy is re-fetched, in minutes
bufferSize · offlineBufferSize	Events held before a flush, and while offline
allowUserOverride	Whether users may override certain policies
notificationsEnabled	Desktop notifications
customBlockMessage · supportEmail · portalUrl	What the Access Blocked page tells the user
debugMode	Verbose logging for troubleshooting

Rollout

1. Force-install the extension and push teamId, integrationId, and the AISPM keys. Confirm that services appear in the discovery inventory.
2. Add the Data Plane keys so interactions appear in Activity.
3. Add the Actions keys with a monitoring policy, review findings over a representative period, then enable blocking and PII enforcement as needed.
4. Set customBlockMessage, supportEmail, and portalUrl before enabling enforcement so blocked users know how to request help.